From patchwork Tue Feb 27 14:54:59 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Armin Wolf X-Patchwork-Id: 13573953 Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C5411384B7; Tue, 27 Feb 2024 14:55:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=212.227.17.20 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709045718; cv=none; b=bGeDqkiyvrH59QdkdbdvjXmSDT4+NLPO3NwdUiHfSUqeEJCBkiepNpzgHyooNCckA0N54XdbOHWz/I4QXwktBuHs1kA28NSY4xfAm/Riyrdqk9Yj2qgovDmOUw30H8Md7Tg/3pnA0kjjM61Ic6fBscilbKfg8EVUW9aOascw6PY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709045718; c=relaxed/simple; bh=MrYA11ydrptEowbuZ9sMuc147woy6xuJ/hcpq4qtb0o=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=moDtMIEYJtq697N+ALhclXw9loMd+N9z402RsPg7crggppbjIW+2Wrnq6NHQ4DmQCK9gq60eeq1pLKFQZjGCGmHQrluDBeI92EajJzk4EMfnK26WfVVbwTVnM+64LRAmNy6l/q4UBLllOZ3Sc57vJ2Hz6044VFhSDWNr27393FY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=gmx.de; spf=pass smtp.mailfrom=gmx.de; dkim=pass (2048-bit key) header.d=gmx.de header.i=w_armin@gmx.de header.b=GROJXJV6; arc=none smtp.client-ip=212.227.17.20 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=gmx.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmx.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmx.de header.i=w_armin@gmx.de header.b="GROJXJV6" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.de; s=s31663417; t=1709045706; x=1709650506; i=w_armin@gmx.de; bh=MrYA11ydrptEowbuZ9sMuc147woy6xuJ/hcpq4qtb0o=; h=X-UI-Sender-Class:From:To:Cc:Subject:Date; b=GROJXJV6thfdkh43yYiA7pMg6bBQOIT85UIY2BBvW8PraCp8lSdVh2HkPBenDk/W /uvBXAk2Ifa3F59oU81IugDQqew4NSWDNheGx1gqXwDilghN9z52Wz1u1DLyO7Nks 2JLS9Wg0xELMgi7KO5HSpdQHpSzGkxluC12HgFhgao3jJHCtRyhN90Nda4nMHd1jy j/BQ+Aly9EfDuXasZ2tAaJH0N+9F4LNBV15+U52UYNBeH4OyGwhh0tufCb9xTPI5h YQROsq3dFwBx8zzRhTeNYg1jMNd0lsTG4c1Q0ne/8Vdy2QZtZREsd6GP3goBG0Tn8 trZoKtyNx7aQUL9dgQ== X-UI-Sender-Class: 724b4f7f-cbec-4199-ad4e-598c01a50d3a Received: from mx-amd-b650.users.agdsn.de ([141.30.226.129]) by mail.gmx.net (mrgmx105 [212.227.17.168]) with ESMTPSA (Nemesis) id 1MMofc-1rMCzO1mZI-00Inal; Tue, 27 Feb 2024 15:55:06 +0100 From: Armin Wolf To: Shyam-sundar.S-k@amd.com Cc: hdegoede@redhat.com, ilpo.jarvinen@linux.intel.com, platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 1/2] platform/x86/amd/pmf: Do not use readl() for policy buffer access Date: Tue, 27 Feb 2024 15:54:59 +0100 Message-Id: <20240227145500.299683-1-W_Armin@gmx.de> X-Mailer: git-send-email 2.39.2 Precedence: bulk X-Mailing-List: platform-driver-x86@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Provags-ID: V03:K1:8KiUowxFm24zflRHFezo2yJ/cJrOmOMZY/AlS3xfkTVnNy3VTYI +ddf09NQGCU6gAYOyOdu/nk3Kf6bSDjeekjJT8paBINFzSi2kIDQDFy4v7hmdAdm1xkrS10 nUr7QTQ4bB11MfW2BpVnXbmBo3fil38YTEamanCLMeV1c/oHvXPx6tzmA3DpCfKiQGXR4/v 73uB/UMRQr0gl4KvkoK8Q== X-Spam-Flag: NO UI-OutboundReport: notjunk:1;M01:P0:a4bzPwQIcSM=;Eb8EQESCSjhnNAP1ad25UgGA6P6 b8CyjvkK1xvlXuGq7oXhYdLvjJ7nS6I39M41B/dYxMWP1hUbOguCBF21UfXqMeBjAv1+P6Mi9 BD6sCqAzPaVkviWaj9AEt+lwz2jaKcy4PLm1bDbdjk665kllTTUSc+sOb6qv/+9u4PE3ECl/B rhYeuTb5L9O7P3sc8xyBGYM49S8WPNUsVaD05DuLAcIau/5FIlxsLwaFYLFH0J89b6ClWTb5A +Bv+vWOCcerPMMIv3fRO91jem2Jp9kR/9oVgiRksFQlH5dkEydAww+H5l5c2tB0ba2FcEt1dr KXMSo/I7BKFEZo6OO4Qb0hNR+jDC+zT6ByEB8DANNp37Hc3EhN4qlZ29yJawsA3UGbC1/Gpon yrlYr7cgLM4/gD7ceezsCF/pzgovJx3vjF5J4qNIWKvp3HocBlZaApq54ourw8us1Kz+yPtrL NWMzaXslIXCp7ohAfHz91rS7GQTOb9Lmvw1iK+pr2Hw1zrTN6TLQuHQc6SW7jey56AaByJssk yK9r+uKWMcyqOSZ/BRSIeqVPiMHNnTliXbxITPDGuUaqVWjTKe8fNxPzW9CUmrC8t3aS8TCiI 3wAxrRL8S1goLkwgucNcycDsxFWbXkNf/CtO46890G0mkdjJRTHAzOlSi7jNqR69Qll2tZ3af 5PEUVIXfrEVreyvxUE/ZTiXLAfw6oFJzJQg6nvmM5J5iBv9Vyc6qOaPwFrLmyR6le1vLeow8I ce/mcmRDaMUGguGlzZhhak1BMZuX/0l/n4GkM8Qrc1d7Tro0Xb7EvmLbd9y265o3EZRBdg87N 5GM6JvBI44a+TWTjJ65sB8wVXFT++AsaYCtBMMlif35QU= The policy buffer is allocated using normal memory allocation functions, so readl() should not be used on it. Compile-tested only. Signed-off-by: Armin Wolf --- Changes since v1: - get the full dword instead of only 8 bits --- drivers/platform/x86/amd/pmf/tee-if.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.39.2 diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c index 16973bebf55f..b3491268b6a0 100644 --- a/drivers/platform/x86/amd/pmf/tee-if.c +++ b/drivers/platform/x86/amd/pmf/tee-if.c @@ -249,8 +249,8 @@ static int amd_pmf_start_policy_engine(struct amd_pmf_dev *dev) u32 cookie, length; int res; - cookie = readl(dev->policy_buf + POLICY_COOKIE_OFFSET); - length = readl(dev->policy_buf + POLICY_COOKIE_LEN); + cookie = *(u32 *)(dev->policy_buf + POLICY_COOKIE_OFFSET); + length = *(u32 *)(dev->policy_buf + POLICY_COOKIE_LEN); if (cookie != POLICY_SIGN_COOKIE || !length) return -EINVAL; From patchwork Tue Feb 27 14:55:00 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Armin Wolf X-Patchwork-Id: 13573954 Received: from mout.gmx.net (mout.gmx.net [212.227.15.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B3CCC13B289; Tue, 27 Feb 2024 14:55:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=212.227.15.15 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709045726; cv=none; b=iBcXdBR7IfXluP2palF86MLFvjcx3jvdRJMA9ODf1DiVOCgfVN1srcksBkl8DzMzX5iYhgyvYlKQIh/KEt1nhT7qxNFnD02QGVYq55jRnV8wudCIr0jTEXR/BGMqKAb0IarbyoRyynTf9yRePuDOCDjZv4vSq2qGz1tqmSTTleY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709045726; c=relaxed/simple; bh=fBLBJnTXEesUlwnv6flfi7CtneDxF1nsqo3zSFZ/SCs=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=D67rGPOroS/7VtcRpTOZOsu1sz7RtHtzSrVlS+IKuWTnu5ferB9KWQ6PIcqLQAzB+YwJHt5VPdphy4vaNk2M55Irug7xC6XwFm7tuVoi4LWO3UoqI2xB/ck88v1ro7617tXsjAeBM10R3yAbTruRzIHhAfUsqANaz9T1uEmOUso= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=gmx.de; spf=pass smtp.mailfrom=gmx.de; dkim=pass (2048-bit key) header.d=gmx.de header.i=w_armin@gmx.de header.b=iV49nW+P; arc=none smtp.client-ip=212.227.15.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=gmx.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmx.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmx.de header.i=w_armin@gmx.de header.b="iV49nW+P" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.de; s=s31663417; t=1709045708; x=1709650508; i=w_armin@gmx.de; bh=fBLBJnTXEesUlwnv6flfi7CtneDxF1nsqo3zSFZ/SCs=; h=X-UI-Sender-Class:From:To:Cc:Subject:Date:In-Reply-To: References; b=iV49nW+PM1NvK+0/Fb5KnrvKctrOzz088gPi78nErBhSlex1JBHymmG9e4ITqitD Gj5N7wEWXWhkYHqHqWj3+oGRDRWtZ2p42J2McAosJkiVb9MhRVT1a5MOYW2Y+7iUk cHm5NzdebPpsrUoW+q7NjgB+VpLy86J/itI8PQsHLdEeSb29XWn6MDBG+LNhRG6TQ SgpRx3wun2SYkmYuWGItwtt+Hlpdjf3DeCPpaqBMxQpHeCxPR+uDA6RorCR4Hy9bw X2I/sb7fOOn4JAAwwWT1xrjmgQkq3qppUWjsIbJI2gWsG8fOck7viHc17uiDwe+sj repCWkx/NSeLGcYWuA== X-UI-Sender-Class: 724b4f7f-cbec-4199-ad4e-598c01a50d3a Received: from mx-amd-b650.users.agdsn.de ([141.30.226.129]) by mail.gmx.net (mrgmx005 [212.227.17.190]) with ESMTPSA (Nemesis) id 1Mulm5-1qoFTz26Vv-00rqYP; Tue, 27 Feb 2024 15:55:08 +0100 From: Armin Wolf To: Shyam-sundar.S-k@amd.com Cc: hdegoede@redhat.com, ilpo.jarvinen@linux.intel.com, platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 2/2] platform/x86/amd/pmf: Fix possible out-of-bound memory accesses Date: Tue, 27 Feb 2024 15:55:00 +0100 Message-Id: <20240227145500.299683-2-W_Armin@gmx.de> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240227145500.299683-1-W_Armin@gmx.de> References: <20240227145500.299683-1-W_Armin@gmx.de> Precedence: bulk X-Mailing-List: platform-driver-x86@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Provags-ID: V03:K1:mwB/4+OQxc3beQYvIPV5xzGZIUOShegwwrNBgf2oo3MXenhZKFn bLP7TMzPgdsBYdgMbfx/KV+sy/zk32uwTlQjBeZRJIXYhi5A1ym5YXoBbmabvZb5R+iEMhH ZpB5nX7NBegF/ok7HNjUd5y5eU8tywxrGPW4gq0k33+ZHTV6bZ6RbHdjHzlj3vgo8gWIi6s d9Y/faRB1BIVmDPrv2Zsw== X-Spam-Flag: NO UI-OutboundReport: notjunk:1;M01:P0:zQEp+AMOBAE=;RccVHBJEzxHJeOPYwc5sLut92VT 4zv4X4Yy9b7mGc4eOoSAwV0vzU+2vlT17wh42WWplCbusylS/AoMQI4gFPMm9r1tlFKpMH4cj KoliPSYlRfOzK09yDNcr4BVYgNGAJitXG0jJVNLED5OoWyLBCv8US2bC+QEagXQEGuD2uHJXD kEYT2FhIxs/YT0XQ1GG3dwalo7xqbSeEag27UGKYPpSJdnVbyktyloz3VDfVDHZlRRL19/Lzk KmrNYiBua4wfQ7NvLYI35MG8Y0AkKxmK0b/aQj258qvq1dzub9DYwNCQODXn0ekUhntJy6FXl SII3l6uVYuW042qxHFQ3vBjjlyhCnD46Ch/amn+UBvP1BQF0fNhUH0D27jCBfVTOi02ry/0Oy m/wJiw5ZFo6ju6q1ER7YrygVrWhLsZeCzqpc3OUYNV9qjSyOM/ferF598b5UpteIg8L8zOe71 XmMlADWNMo2x96JmPRAiVl7sTwbCSm0vjzjSRE166YO+cgwhQN4a7wwO8oceBmS4bGUzLY7ZF XZS8nyZJ3uShNWldDXzCBJYvJNEUCINCENB0bjx0GI/XLAS4B1OuqUkgbhvk8ev18EULiUyp4 zEUKdEntPWmYJqsnXb8uNFX8Juamh3KKhQ3/5Dqd1BHkQfBe6LpY147A0n+xZaX0kEcDo6a08 V1fYHsNUHZwpO623W0TIZMzU127Ur3DcMgGevEQTm23N0WhNloakK7MMnbn6AaeZQDdpRgxP0 jXEU6rOLuQHSQL8HXXpyislqhz3PtZkmRi8+bjg9hb/TSLQwhOkA9v0vNu5eDJDZ3mjKdyFS3 n7xWznp81IBYR5mP9/gCMWqg/Rw+VxprF0Z6IfKFaOCnM= The length of the policy buffer is not validated before accessing it, which means that multiple out-of-bounds memory accesses can occur. This is especially bad since userspace can load policy binaries over debugfs. Compile-tested only. Signed-off-by: Armin Wolf --- Changes since v1: - check if the policy buffer also has enough room for storing the length --- drivers/platform/x86/amd/pmf/tee-if.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.39.2 diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c index b3491268b6a0..09e3c620a9c7 100644 --- a/drivers/platform/x86/amd/pmf/tee-if.c +++ b/drivers/platform/x86/amd/pmf/tee-if.c @@ -249,12 +249,18 @@ static int amd_pmf_start_policy_engine(struct amd_pmf_dev *dev) u32 cookie, length; int res; + if (dev->policy_sz < POLICY_COOKIE_LEN + sizeof(length)) + return -EINVAL; + cookie = *(u32 *)(dev->policy_buf + POLICY_COOKIE_OFFSET); length = *(u32 *)(dev->policy_buf + POLICY_COOKIE_LEN); if (cookie != POLICY_SIGN_COOKIE || !length) return -EINVAL; + if (dev->policy_sz < length + 512) + return -EINVAL; + /* Update the actual length */ dev->policy_sz = length + 512; res = amd_pmf_invoke_cmd_init(dev);